PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
November 13, 2026
Attackers chained PHP2Shell flaws with a new Gaia OS root bug, CVE-2026-123039, to install the TSGA backdoor on Check Point
Cybersecurity
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
Attackers chained PHP2Shell flaws with a new Gaia OS root bug, CVE-2026-123039, to install the TSGA backdoor on Check Point gateways and wipe ESXi hosts.
N-able N-central Zero-Days Exploited Hours After PoC Release
Attackers hijacked at least 21 N-able N-central servers within hours of a PoC release for 4EverAble2Shell and Agent2Shell, including 19 with Hotfix 2 applied.
Operation Endgame Seizes 235 Servers Tied to Gootloader, StealC
Europol-led Operation Endgame seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, exposing 6.4 million stolen credential datasets.
DOJ Seizes $1.2B of North Korea’s Binance Haul, Disrupts FaceStealer
The DOJ obtained authority to seize over $1.2 billion of the roughly $6.3 billion stolen from Binance, while the FBI disrupted North Korea's FaceStealer scheme.
TSMC Confirms Employee Data Leak Traced to Third-Party Cloud Vendor
TSMC confirmed some current and former employee data appeared online without authorization via a cloud provider, and found no breach of its own systems.
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
Citrix fixed 31 CVEs across four bulletins, including 28 NetScaler ADC and Gateway memory flaws and a CVSS 9.4 NetScaler Console authentication bypass.
Apify Rotates API Tokens and Urges 2FA Resets After Breach
Apify rotated API tokens and proxy passwords and reset all sessions after an intruder reached internal systems on November 9 and 10, with 2FA exposure ...
PostgreSQL Fixes 52 Vulnerabilities and Ends Support for Version 14
PostgreSQL releases 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 security flaws, the largest batch on record, and 14.25 is the final version 14 release.
PTC Patches Critical Windchill and FlexPLM Flaw CVE-2026-126325
PTC fixed CVE-2026-126325, a CVSS 9.2 deserialization flaw in Windchill and FlexPLM that allows remote code execution; self-hosted customers must patch.
Zoho Publishes Eight Critical ManageEngine CVEs, One Rated 9.9
Zoho disclosed eight critical ManageEngine flaws, led by CVE-2026-12591, a CVSS 9.9 privilege escalation in M365 Manager Plus, plus bugs in DDI Central.
N-able N-central Zero-Days Exploited Hours After PoC Release
November 13, 2026
Attackers hijacked at least 21 N-able N-central servers within hours of a PoC release for 4EverAble2Shell and Agent2Shell, including 19
Operation Endgame Seizes 235 Servers Tied to Gootloader, StealC
November 13, 2026
Europol-led Operation Endgame seized 235 servers and 257 domains tied to Gootloader, CastleRAT and StealC, exposing 6.4 million stolen credential
DOJ Seizes $1.2B of North Korea’s Binance Haul, Disrupts FaceStealer
November 13, 2026
The DOJ obtained authority to seize over $1.2 billion of the roughly $6.3 billion stolen from Binance, while the FBI
TSMC Confirms Employee Data Leak Traced to Third-Party Cloud Vendor
November 13, 2026
TSMC confirmed some current and former employee data appeared online without authorization via a cloud provider, and found no breach
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
November 13, 2026
Citrix fixed 31 CVEs across four bulletins, including 28 NetScaler ADC and Gateway memory flaws and a CVSS 9.4 NetScaler
Apify Rotates API Tokens and Urges 2FA Resets After Breach
November 13, 2026
Apify rotated API tokens and proxy passwords and reset all sessions after an intruder reached internal systems on November 9
PostgreSQL Fixes 52 Vulnerabilities and Ends Support for Version 14
November 13, 2026
PostgreSQL releases 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 security flaws, the largest batch on record, and 14.25 is
PTC Patches Critical Windchill and FlexPLM Flaw CVE-2026-126325
November 13, 2026
PTC fixed CVE-2026-126325, a CVSS 9.2 deserialization flaw in Windchill and FlexPLM that allows remote code execution; self-hosted customers must
Zoho Publishes Eight Critical ManageEngine CVEs, One Rated 9.9
November 13, 2026
Zoho disclosed eight critical ManageEngine flaws, led by CVE-2026-12591, a CVSS 9.9 privilege escalation in M365 Manager Plus, plus bugs
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.